Explotación pública

Catálogo de exploits

Todo exploit público que catalogamos, en un solo índice. Busca por CVE, nombre del exploit o tecnología — y mira, al lado, lo que la falla realmente vale: severidad, probabilidad de explotación y si ya está bajo ataque.

83.780exploits catalogados
39.319CVEs con explotación pública
24.695probados en laboratorio
TodosReferência 25.394Exploit-DB 24.485GitHub PoC 16.249VulnCheck XDB 9651Nuclei 4478Metasploit 3523✓ solo verificadosrecientespopularesriesgo
4478 exploits
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43169MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Users Access Groups feature (/index.php?module=users_groups/use
28RIESGO
abrir ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross Site Scripting
CVE-2022-43170MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Dashboard Configuration feature (index.php?module=dashboard_con
28RIESGO
abrir ↗
Nucleimedium
Rukovoditel <= 3.2.1 - Cross-Site Scripting
CVE-2022-43185MEDIUM
A stored cross-site scripting (XSS) vulnerability in the Configuration/Holidays module of Rukovoditel v3.2.1 allows atta
28RIESGO
abrir ↗
Nucleimedium
WordPress Events Calendar <1.4.5 - Cross-Site Scripting
CVE-2022-4320MEDIUM
WordPress Events Calendar Plugin < 1.4.5 - Multiple Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
PDF Generator for WordPress < 1.1.2 - Cross Site Scripting
CVE-2022-4321MEDIUM
PDF Generator for WordPress < 1.1.2 - Reflected XSS
28RIESGO
abrir ↗
Nucleimedium
WordPress Post Status Notifier Lite <1.10.1 - Cross-Site Scripting
CVE-2022-4325MEDIUM
Post Status Notifier Lite < 1.10.1 - Reflected XSS
28RIESGO
abrir ↗
Nucleicritical
WooCommerce Checkout Field Manager < 18.0 - Arbitrary File Upload
CVE-2022-4328CRITICAL
WooCommerce Checkout Field Manager < 18.0 - Unauthenticated Arbitrary File Upload
63RIESGO
abrir ↗
Nucleicritical
Mingsoft MCMS - SQL Injection
CVE-2022-4375MEDIUM
Mingsoft MCMS list sql injection
28RIESGO
abrir ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Remote Code Execution
CVE-2022-43769HIGHbajo ataque
Hitachi Vantara Pentaho Business Analytics Server - Failure to Sanitize Special Elements into a Different Plane (Special Element Injection)
100RIESGO
abrir ↗
Nucleihigh
Hitachi Pentaho Business Analytics Server - Bypass Authorization
CVE-2022-43939HIGHbajo ataque
Hitachi Vantara Pentaho Business Analytics Server - Use of Non-Canonical URL Paths for Authorization Decisions
100RIESGO
abrir ↗
Nucleicritical
WebTareas 2.4p5 - SQL Injection
CVE-2022-44290CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in deleteapprovalstages.php
43RIESGO
abrir ↗
Nucleicritical
WebTareas 2.4p5 - SQL Injection
CVE-2022-44291CRITICAL
webTareas 2.4p5 was discovered to contain a SQL injection vulnerability via the id parameter in phasesets.php.
43RIESGO
abrir ↗
Nucleihigh
WAVLINK Quantum D4G (WL-WN531G3) - Information Disclosure
CVE-2022-44356HIGH
WAVLINK Quantum D4G (WL-WN531G3) running firmware versions M31G3.V5030.201204 and M31G3.V5030.200325 has an access contr
36RIESGO
abrir ↗
Nucleicritical
Steveas WP Live Chat Shoutbox <= 1.4.2 - SQL Injection
CVE-2023-1020CRITICAL
Steveas WP Live Chat Shoutbox <= 1.4.2 - Unauthenticated SQLi
63RIESGO
abrir ↗
Nucleimedium
WordPress GN Publisher <1.5.6 - Cross-Site Scripting
CVE-2023-1080MEDIUM
GN Publisher <= 1.5.5 - Reflected Cross-Site Scripting
28RIESGO
abrir ↗
Nucleimedium
WP-Optimize WordPress plugin < 3.2.13 - Cross-Site Scripting
CVE-2023-1119MEDIUM
Multiple Plugins - Cross-Site Scripting From Third-party Library
28RIESGO
abrir ↗
Nucleicritical
Mlflow <2.2.1 - Local File Inclusion
CVE-2023-1177CRITICAL
Path Traversal: '\..\filename' in mlflow/mlflow
75RIESGO
abrir ↗
Nucleimedium
Coming Soon & Maintenance < 4.1.7 - Unauthenticated Post/Page Access
CVE-2023-1263MEDIUM
CMP – Coming Soon & Maintenance Plugin by NiteoThemes <= 4.1.6 - Information Exposure
28RIESGO
abrir ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1315MEDIUM
Cross-site Scripting (XSS) - Reflected in osticket/osticket
28RIESGO
abrir ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1317MEDIUM
Cross-site Scripting (XSS) - Reflected in osticket/osticket
28RIESGO
abrir ↗
Nucleimedium
osTicket < v1.16.6 - Cross-Site Scripting
CVE-2023-1318MEDIUM
Cross-site Scripting (XSS) - Generic in osticket/osticket
28RIESGO
abrir ↗
Nucleimedium
unilogies/bumsys < v2.0.2 - Clickjacking
CVE-2023-1362HIGH
Improper Restriction of Rendered UI Layers or Frames in unilogies/bumsys
36RIESGO
abrir ↗
Nucleicritical
TP-Link Archer AX21 (AX1800) - Unauthenticated Command Injection
CVE-2023-1389HIGHbajo ataque
TP-Link Archer AX21 (AX1800) firmware versions before 1.1.4 Build 20230219 contained a command injection vulnerability i
100RIESGO
abrir ↗
Nucleihigh
Video List Manager <= 1.7 - SQL Injection
CVE-2023-1408HIGH
Video List Manager <= 1.7 - Admin+ SQL Injection
36RIESGO
abrir ↗
Nucleicritical
Jeecg-boot 3.5.0 qurestSql - SQL Injection
CVE-2023-1454MEDIUM
jeecg-boot qurestSql sql injection
60RIESGO
abrir ↗
Nucleimedium
Imgproxy < 3.14.0 - Cross-site Scripting (XSS)
CVE-2023-1496MEDIUM
Cross-site Scripting (XSS) - Reflected in imgproxy/imgproxy
28RIESGO
abrir ↗
Nucleimedium
MyCryptoCheckout < 2.124 - Cross-Site Scripting
CVE-2023-1546MEDIUM
MyCryptoCheckout < 2.124 - Reflected XSS
28RIESGO
abrir ↗
Nucleicritical
Sophos Web Appliance - Remote Code Execution
CVE-2023-1671CRITICALbajo ataque
A pre-auth command injection vulnerability in the warn-proceed handler of Sophos Web Appliance older than version 4.3.10
100RIESGO
abrir ↗
Nucleicritical
WAGO - Remote Command Execution
CVE-2023-1698CRITICAL
WAGO: WBM Command Injection in multiple products
85RIESGO
abrir ↗
Nucleicritical
Bitrix Component - Cross-Site Scripting
CVE-2023-1719HIGH
Bitrix24 Insecure Global Variable Extraction
36RIESGO
abrir ↗
← anteriorpágina 85 / 150siguiente →

Indexamos solo el enlace público a la prueba de concepto — nunca alojamos ni redistribuimos código de explotación. Fuentes: PoC-in-GitHub, Exploit-DB, Nuclei, Metasploit y VulnCheck XDB. La existencia de PoC pública no significa que la falla sea explotable en tu entorno.